Femwar02

No known aliases in database

▲ High Threat

Sapienza University of Rome Ransomware Attack

Origin Russia

Motivation financial extortion

Target Sectors

Education Higher Education Research Institutions

Hybrid encryption (curve25519 and hc-128)

Partial file encryption

Direct system calls for evasion

Domain-wide propagation via Group Policy

DLL sideloading (DarkLoader)

Exploitation of Zimbra vulnerabilities

Phishing

Encrypted payloads

CISA Advisories ↗

Hacking the mainframe…